Overview

overview

10

Static

static

e272f32a45...le.exe

windows7_x64

10

e272f32a45...le.exe

windows10_x64

10

Analysis

  • max time kernel
    152s
  • max time network
    154s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    26-07-2021 13:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e272f32a45aa342b823aaf26687357f45f39d4f836d3529169340e4893c08c37.sample.exe

  • Size

    348KB

  • MD5

    d0d3086cd72eb31385bf6406042cc404

  • SHA1

    11f9bb5c17fe32b48d44575a29e94dd082d38483

  • SHA256

    e272f32a45aa342b823aaf26687357f45f39d4f836d3529169340e4893c08c37

  • SHA512

    153dce24258abfc3440208b100c26a847c2396fe7893844ba8d8e66659e4cd567d2ab8ac9d9d19e7cdc80b6dc89080b1966bf5f2d82ef76bfc814902beae071e

Score
10/10
evasionpersistenceransomwarespywarestealersuricata

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-3686645723-710336880-414668232-1000\how_recover+lhf.txt

Ransom Note
111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) What does this mean ? This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them. 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 How did this happen ? ---Specially for your PC was generated personal RSA-4096 KEY, both public and private. ---ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111 Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server. What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BTC NOW, and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://vr6g2curb2kcidou.encpayment23.com/8DB09D80909DABC 2. http://vr6g2curb2kcidou.expay34.com/8DB09D80909DABC 3. http://psbc532jm8c.hsh73cu37n1.net/8DB09D80909DABC 4. https://vr6g2curb2kcidou.onion.to/8DB09D80909DABC If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: vr6g2curb2kcidou.onion/8DB09D80909DABC 4. Follow the instructions on the site. IMPORTANT INFORMATION: Your personal pages: http://vr6g2curb2kcidou.encpayment23.com/8DB09D80909DABC http://vr6g2curb2kcidou.expay34.com/8DB09D80909DABC http://psbc532jm8c.hsh73cu37n1.net/8DB09D80909DABC https://vr6g2curb2kcidou.onion.to/8DB09D80909DABC Your personal page (using TOR-Browser): vr6g2curb2kcidou.onion/8DB09D80909DABC Your personal identification number (if you open the site (or TOR-Browser's) directly): 8DB09D80909DABC 111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111
URLs

http://vr6g2curb2kcidou.encpayment23.com/8DB09D80909DABC

http://vr6g2curb2kcidou.expay34.com/8DB09D80909DABC

http://psbc532jm8c.hsh73cu37n1.net/8DB09D80909DABC

https://vr6g2curb2kcidou.onion.to/8DB09D80909DABC

http://vr6g2curb2kcidou.onion/8DB09D80909DABC

Extracted

Path

C:\Users\Admin\Desktop\Howto_RESTORE_FILES.html

Ransom Note
NOT YOUR LANGUAGE? USE Google Translate What happened to your files? protected by a strong encryption with RSA-4096 More information about the encryption RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) does this mean? means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them. All your files were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of YOUR FILES is only possible with the help of the private key and decrypt program, which is on our Secret Server!!! * do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed. If you really need your data, then we suggest you do not waste valuable time searching for other solutions becausen they do not exist. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1.http://vr6g2curb2kcidou.encpayment23.com/8DB09D80909DABC 2.http://vr6g2curb2kcidou.expay34.com/8DB09D80909DABC 3.http://psbc532jm8c.hsh73cu37n1.net/8DB09D80909DABC 4.https://vr6g2curb2kcidou.onion.to/8DB09D80909DABC If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the tor-browser address bar: vr6g2curb2kcidou.onion/8DB09D80909DABC 4. Follow the instructions on the site. IMPORTANT INFORMATION: Your Personal PAGES: http://vr6g2curb2kcidou.encpayment23.com/8DB09D80909DABC http://vr6g2curb2kcidou.expay34.com/8DB09D80909DABC http://psbc532jm8c.hsh73cu37n1.net/8DB09D80909DABC https://vr6g2curb2kcidou.onion.to/8DB09D80909DABC Your Personal PAGES (using TOR-Browser): vr6g2curb2kcidou.onion/8DB09D80909DABC Your personal code (if you open the site (or TOR-Browser's) directly):
URLs

http://vr6g2curb2kcidou.onion/8DB09D80909DABC

http://vr6g2curb2kcidou.encpayment23.com/8DB09D80909DABC

http://vr6g2curb2kcidou.expay34.com/8DB09D80909DABC

http://psbc532jm8c.hsh73cu37n1.net/8DB09D80909DABC

https://vr6g2curb2kcidou.onion.to/8DB09D80909DABC

Signatures

  • suricata: ET MALWARE AlphaCrypt CnC Beacon 5
    suricata
  • suricata: ET MALWARE AlphaCrypt CnC Beacon 6
    suricata
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs
    ransomwareevasion
  • Executes dropped EXE 2 IoCs
  • Modifies extensions of user files 5 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\e272f32a45aa342b823aaf26687357f45f39d4f836d3529169340e4893c08c37.sample.exe
    "C:\Users\Admin\AppData\Local\Temp\e272f32a45aa342b823aaf26687357f45f39d4f836d3529169340e4893c08c37.sample.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2256
    • C:\Users\Admin\AppData\Local\Temp\e272f32a45aa342b823aaf26687357f45f39d4f836d3529169340e4893c08c37.sample.exe
      "C:\Users\Admin\AppData\Local\Temp\e272f32a45aa342b823aaf26687357f45f39d4f836d3529169340e4893c08c37.sample.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3484
      • C:\Users\Admin\AppData\Roaming\mxeqtacroic.exe
        C:\Users\Admin\AppData\Roaming\mxeqtacroic.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3628
        • C:\Users\Admin\AppData\Roaming\mxeqtacroic.exe
          C:\Users\Admin\AppData\Roaming\mxeqtacroic.exe
          4⤵
          • Executes dropped EXE
          • Modifies extensions of user files
          • Checks computer location settings
          • Drops startup file
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:412
          • C:\Windows\SYSTEM32\bcdedit.exe
            bcdedit.exe /set {current} bootems off
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:2424
          • C:\Windows\System32\vssadmin.exe
            "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
            5⤵
            • Interacts with shadow copies
            PID:3768
          • C:\Windows\SYSTEM32\bcdedit.exe
            bcdedit.exe /set {current} advancedoptions off
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:2232
          • C:\Windows\SYSTEM32\bcdedit.exe
            bcdedit.exe /set {current} optionsedit off
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:1852
          • C:\Windows\SYSTEM32\bcdedit.exe
            bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:1308
          • C:\Windows\SYSTEM32\bcdedit.exe
            bcdedit.exe /set {current} recoveryenabled off
            5⤵
            • Modifies boot configuration data using bcdedit
            PID:3436
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Howto_RESTORE_FILES.txt
            5⤵
            • Opens file in notepad (likely ransom note)
            PID:3616
          • C:\Windows\System32\vssadmin.exe
            "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
            5⤵
            • Interacts with shadow copies
            PID:4124
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Roaming\MXEQTA~1.EXE
            5⤵
              PID:4448
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\E272F3~1.EXE
          3⤵
            PID:1956
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2012
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
        1⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1908
      • C:\Windows\system32\browser_broker.exe
        C:\Windows\system32\browser_broker.exe -Embedding
        1⤵
        • Modifies Internet Explorer settings
        PID:3752
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4184
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:4272
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:4536
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        PID:4692

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Privilege Escalation

      Defense Evasion

      File Deletion

      2
      T1107

      Modify Registry

      3
      T1112

      Credential Access

      Credentials in Files

      1
      T1081

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      2
      T1082

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Exfiltration

      Command and Control

      Impact

      Inhibit System Recovery

      3
      T1490

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\how_recover+lhf.html
        MD5

        bdedc3c9607ac3bfd8f8be7c646deae8

        SHA1

        169b3038c633c1875a9ab29e2cdb02225719bf0f

        SHA256

        9b8bad18e991e85ce1b08f2ea16da595969e19cc74f9ae3e14a93b1a89fa6d9c

        SHA512

        8547963b59acdad8f8b6cdb3186e225f13e905a082ac04fed9f42390dbe2db8c6aab3b60b3543281d176b3c620cf20b34514e76e121c22bd17a79d48ca67789f

        Download Submit
      • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\how_recover+lhf.txt
        MD5

        5f10ddb4a89b98007dca0be0b9eaf81d

        SHA1

        44b25d3769c928ad93bdfd851e6e450298ac2652

        SHA256

        9a2248253201c56a35949a943dba4de9db11766c7daf7e9c482f377161f1a584

        SHA512

        e133e38c49cca594cecc987f01ea5dce2e2562df4a781ed03c736106e2d544ea0dc8c3f341e6506e37dfac6b90677148d82286dae34777512fdc22a37819b581

        Download Submit
      • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\how_recover+lhf.html
        MD5

        bdedc3c9607ac3bfd8f8be7c646deae8

        SHA1

        169b3038c633c1875a9ab29e2cdb02225719bf0f

        SHA256

        9b8bad18e991e85ce1b08f2ea16da595969e19cc74f9ae3e14a93b1a89fa6d9c

        SHA512

        8547963b59acdad8f8b6cdb3186e225f13e905a082ac04fed9f42390dbe2db8c6aab3b60b3543281d176b3c620cf20b34514e76e121c22bd17a79d48ca67789f

        Download Submit
      • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\how_recover+lhf.txt
        MD5

        5f10ddb4a89b98007dca0be0b9eaf81d

        SHA1

        44b25d3769c928ad93bdfd851e6e450298ac2652

        SHA256

        9a2248253201c56a35949a943dba4de9db11766c7daf7e9c482f377161f1a584

        SHA512

        e133e38c49cca594cecc987f01ea5dce2e2562df4a781ed03c736106e2d544ea0dc8c3f341e6506e37dfac6b90677148d82286dae34777512fdc22a37819b581

        Download Submit
      • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\how_recover+lhf.html
        MD5

        bdedc3c9607ac3bfd8f8be7c646deae8

        SHA1

        169b3038c633c1875a9ab29e2cdb02225719bf0f

        SHA256

        9b8bad18e991e85ce1b08f2ea16da595969e19cc74f9ae3e14a93b1a89fa6d9c

        SHA512

        8547963b59acdad8f8b6cdb3186e225f13e905a082ac04fed9f42390dbe2db8c6aab3b60b3543281d176b3c620cf20b34514e76e121c22bd17a79d48ca67789f

        Download Submit
      • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\how_recover+lhf.txt
        MD5

        5f10ddb4a89b98007dca0be0b9eaf81d

        SHA1

        44b25d3769c928ad93bdfd851e6e450298ac2652

        SHA256

        9a2248253201c56a35949a943dba4de9db11766c7daf7e9c482f377161f1a584

        SHA512

        e133e38c49cca594cecc987f01ea5dce2e2562df4a781ed03c736106e2d544ea0dc8c3f341e6506e37dfac6b90677148d82286dae34777512fdc22a37819b581

        Download Submit
      • C:\Users\Admin\AppData\Roaming\mxeqtacroic.exe
        MD5

        d0d3086cd72eb31385bf6406042cc404

        SHA1

        11f9bb5c17fe32b48d44575a29e94dd082d38483

        SHA256

        e272f32a45aa342b823aaf26687357f45f39d4f836d3529169340e4893c08c37

        SHA512

        153dce24258abfc3440208b100c26a847c2396fe7893844ba8d8e66659e4cd567d2ab8ac9d9d19e7cdc80b6dc89080b1966bf5f2d82ef76bfc814902beae071e

        Download Submit
      • C:\Users\Admin\AppData\Roaming\mxeqtacroic.exe
        MD5

        d0d3086cd72eb31385bf6406042cc404

        SHA1

        11f9bb5c17fe32b48d44575a29e94dd082d38483

        SHA256

        e272f32a45aa342b823aaf26687357f45f39d4f836d3529169340e4893c08c37

        SHA512

        153dce24258abfc3440208b100c26a847c2396fe7893844ba8d8e66659e4cd567d2ab8ac9d9d19e7cdc80b6dc89080b1966bf5f2d82ef76bfc814902beae071e

        Download Submit
      • C:\Users\Admin\AppData\Roaming\mxeqtacroic.exe
        MD5

        d0d3086cd72eb31385bf6406042cc404

        SHA1

        11f9bb5c17fe32b48d44575a29e94dd082d38483

        SHA256

        e272f32a45aa342b823aaf26687357f45f39d4f836d3529169340e4893c08c37

        SHA512

        153dce24258abfc3440208b100c26a847c2396fe7893844ba8d8e66659e4cd567d2ab8ac9d9d19e7cdc80b6dc89080b1966bf5f2d82ef76bfc814902beae071e

        Download Submit
      • C:\Users\Admin\Desktop\Howto_RESTORE_FILES.html
        MD5

        bdedc3c9607ac3bfd8f8be7c646deae8

        SHA1

        169b3038c633c1875a9ab29e2cdb02225719bf0f

        SHA256

        9b8bad18e991e85ce1b08f2ea16da595969e19cc74f9ae3e14a93b1a89fa6d9c

        SHA512

        8547963b59acdad8f8b6cdb3186e225f13e905a082ac04fed9f42390dbe2db8c6aab3b60b3543281d176b3c620cf20b34514e76e121c22bd17a79d48ca67789f

        Download Submit
      • C:\Users\Admin\Desktop\Howto_RESTORE_FILES.txt
        MD5

        5f10ddb4a89b98007dca0be0b9eaf81d

        SHA1

        44b25d3769c928ad93bdfd851e6e450298ac2652

        SHA256

        9a2248253201c56a35949a943dba4de9db11766c7daf7e9c482f377161f1a584

        SHA512

        e133e38c49cca594cecc987f01ea5dce2e2562df4a781ed03c736106e2d544ea0dc8c3f341e6506e37dfac6b90677148d82286dae34777512fdc22a37819b581

        Download Submit
      • memory/412-124-0x0000000000409350-mapping.dmp
        Download
      • memory/412-126-0x0000000000400000-0x0000000000485000-memory.dmp
        Filesize

        532KB

        Download
      • memory/1308-131-0x0000000000000000-mapping.dmp
        Download
      • memory/1852-130-0x0000000000000000-mapping.dmp
        Download
      • memory/1956-120-0x0000000000000000-mapping.dmp
        Download
      • memory/2232-129-0x0000000000000000-mapping.dmp
        Download
      • memory/2256-114-0x0000000000760000-0x00000000008AA000-memory.dmp
        Filesize

        1.3MB

        Download
      • memory/2424-127-0x0000000000000000-mapping.dmp
        Download
      • memory/3436-132-0x0000000000000000-mapping.dmp
        Download
      • memory/3484-121-0x0000000000400000-0x0000000000485000-memory.dmp
        Filesize

        532KB

        Download
      • memory/3484-115-0x0000000000400000-0x0000000000485000-memory.dmp
        Filesize

        532KB

        Download
      • memory/3484-116-0x0000000000409350-mapping.dmp
        Download
      • memory/3616-133-0x0000000000000000-mapping.dmp
        Download
      • memory/3628-122-0x0000000000760000-0x00000000008AA000-memory.dmp
        Filesize

        1.3MB

        Download
      • memory/3628-117-0x0000000000000000-mapping.dmp
        Download
      • memory/3768-128-0x0000000000000000-mapping.dmp
        Download
      • memory/4124-136-0x0000000000000000-mapping.dmp
        Download
      • memory/4448-138-0x0000000000000000-mapping.dmp
        Download